Privacy Policy

1. Scope and Core Purpose

COMBINE is an athletic evaluation, message board, direct messaging, and peer-to-peer equipment marketplace platform. To deliver these Services, we collect and display personal information, performance statistics, and media (such as athlete profiles, athletic metrics, videos, photos, and team affiliations).

We are committed to data minimization and transparency. We process personal information only as necessary to provide our platform features, comply with legal obligations, and maintain platform security.

2. Information We Collect and How We Collect It

2.1 Information You Provide Directly

Account Registration: When you register for a user account, we collect your name, email address, and contact details. Accounts are held by adults — parents and legal guardians, coaches, and COMBINE staff. Authentication is handled by our infrastructure provider; COMBINE does not store your password.

Athlete Profiles & Submissions: If you create or manage an athlete profile, we collect athletic data, including name, graduation year, position, height, weight, high school/club team, event statistics, metric data, photos, and uploaded video files.

Marketplace Listings: If you post items for sale on our classified marketplace, we collect listing titles, descriptions, price, item condition, general location (city and state), and up to seven (7) uploaded photos per listing.

Communications & Reports: When you contact customer support, submit feedback, or file a report against user content, we collect your email address and the content of your submission.

2.2 System & Interaction Data Collected Automatically

To maintain session authentication and core application functionality, our servers automatically collect limited technical data:

Essential Authentication Cookies: We do not use third-party advertising, analytics, tracking, or behavioral cookies. We use only strictly necessary session cookies required to keep you securely signed in to your account.

System Log Files: Our servers automatically record standard server log information, such as your IP address, browser type, operating system, access times, and requested page URLs.

Message Board Read State: To provide a seamless user experience, our database records per-user read states, logging which threads a signed-in user has read and when.

3. Direct Messaging (DM) & Administrative Access Disclosure

The Site provides a private Direct Messaging tool allowing registered users to communicate.

Anti-Harassment Limits: Unsolicited outreach is restricted to one (1) initial message. Recipients must accept a message request before further messages can be transmitted. Blocking is enforced symmetrically — neither party can contact the other, and a blocked user's board posts no longer appear in your view.

Message Retention: Messages sent via Direct Messaging are retained in our database. Sent messages cannot be edited or deleted by users. Moderated messages are hidden rather than permanently deleted.

IMPORTANT DISCLOSURE — ADMINISTRATIVE ACCESS TO REPORTED MESSAGES: Private direct messages are confidential between conversation participants. HOWEVER, IF A USER FILES A REPORT AGAINST A PRIVATE CONVERSATION OR INDIVIDUAL MESSAGE (E.G., FOR HARASSMENT, UNWANTED CONTACT, OR CHILD SAFETY CONCERNS), THAT REPORT GRANTS COMBINE ADMINISTRATORS EXPLICIT AUTHORIZATION TO ACCESS, READ, REVIEW, AND RETAIN THE CONVERSATION HISTORY ASSOCIATED WITH THAT REPORT. Administrators do not have general browsing access to private messages; access is strictly unlocked by an open report, and closes again once that report has been actioned or dismissed.

4. How We Disclose and Share Information

We do not sell your personal information or share it with third parties for cross-context behavioral advertising. We disclose personal information only in the following contexts:

4.1 Third-Party Service Providers

We partner with trusted third-party service providers to support our platform infrastructure:

Supabase (Database, Authentication and File Storage): Your account, athlete records, measurements, messages, listings and uploaded media are stored on infrastructure operated by Supabase. Authentication is also handled by Supabase, which is why COMBINE never stores your password.

Stripe, Inc. (Payment Processing): Subscription and event registration payments are processed securely by Stripe. COMBINE does not store raw payment card data. Your payment information is governed by Stripe's privacy policy.

Lovable (Application Hosting & Diagnostics): Our web application is hosted on Lovable. When runtime application or system errors occur, technical error logs and diagnostic stack traces are transmitted to Lovable to assist in bug resolution and platform stability.

4.2 Peer-to-Peer Marketplace Interactions

COMBINE operates a classified listing board only and does not process marketplace payments. When you list an item or respond to a listing, interactions occur directly between you and the other user. Listing-attached message threads automatically close 14 days after an item is marked sold or immediately if a listing is hidden by a moderator.

4.3 Legal Compliance and Safety

We may disclose your information if required to do so by law, court order, subpoena, or governmental regulation, or if we believe in good faith that disclosure is necessary to:

• Comply with legal process;
• Enforce our Terms of Service or Community Guidelines;
• Investigate reports of abuse, harassment, or unlawful conduct; or
• Protect the safety, rights, or property of COMBINE, our users, or the public.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of COMBINE assets, user account data and profile information may be transferred as a business asset.

5. Children's Privacy & COPPA Notice

The Site provides services involving high school and youth athletes, including individuals under 13 years of age ("Children" or "Child"). We comply strictly with the Children's Online Privacy Protection Act ("COPPA").

Verifiable Parental Consent: Prior to collecting or publishing personal information for a Child, COMBINE requires verifiable parental consent in accordance with our COPPA Notice.

Visibility of Athletes Under 13: Profiles for athletes under the age of 13 are not discoverable by coaches, scouts, or other subscribers by default, and cannot be made discoverable by the athlete or by any account other than a verified parent or legal guardian.

An under-13 athlete's profile becomes discoverable only when all of the following are on record and remain in force:

1. The guardian has marked the profile as public;
2. The guardian has granted public directory consent for that athlete; and
3. Verifiable parental consent under COPPA has been obtained from the guardian through payment card verification.

If any of these is absent, withdrawn, or revoked, the profile ceases to be discoverable. These conditions are enforced by the Site and cannot be bypassed through the application interface.

Parental Rights: Parents or legal guardians may review, request deletion of, or refuse further collection of their Child's personal information at any time by contacting us at support@combinebaseball.com.

6. Privacy Rights (State & International Disclosures)

6.1 California Residents (CCPA / CPRA)

If you are a California resident, you have specific rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to Know: Request details regarding the categories and specific pieces of personal data we collect, use, and disclose.
• Right to Delete: Request deletion of your personal data, subject to legal exceptions.
• Right to Correct: Request corrections to inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: COMBINE does not sell or share personal information for cross-context behavioral advertising.
• Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

California Minors (Under 18): If you are a California resident under 18 and cannot remove content you publicly posted on the Site, you may request removal by contacting support@combinebaseball.com. Content will be anonymized or hidden from public view in accordance with applicable law.

6.2 Canadian Residents (PIPEDA Compliance)

COMBINE complies with the Personal Information Protection and Electronic Documents Act (PIPEDA). Canadian residents have the right to be informed of data collection purposes, access their personal information, request corrections, or withdraw consent (subject to legal or contractual retention needs). Access requests will be handled within 30 days.

7. Data Retention and Content Moderation

Soft-Deletion Model: To maintain historical record integrity, audit logs, and safety queue contexts, user content (including message board posts, marketplace listings, and direct messages) is hidden upon moderation rather than permanently deleted from our live database. We record who hid the content, when, and the stated reason.

Reporting Queues: Reports submitted across any target type retain status logs (open, actioned, dismissed), reviewer identity, and reviewer notes permanently for safety compliance.

8. Updates to This Privacy Policy

COMBINE reserves the right to update or modify this Privacy Policy at any time. When changes are made, we will update the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

9. Contact Us

If you have questions, privacy requests, COPPA inquiries, or wish to exercise your data protection rights, please contact us at:

Combine Baseball LLC

Email: support@combinebaseball.com

Website: www.combinebaseball.com